Namespace Isolation

from dakera import DakeraClient
import os

# Admin client — server-side only, never exposed to tenants
admin = DakeraClient(
    base_url="http://localhost:3300",
    api_key=os.environ["DAKERA_ADMIN_KEY"]
)

class TenantMemoryService:
    """
    Service layer for multi-tenant memory operations.
    Each tenant gets their own Dakera namespace and scoped key.
    """

    def __init__(self, admin_client: DakeraClient):
        self._admin = admin_client
        self._tenant_clients: dict = {}

    def provision_tenant(self, tenant_id: str) -> str:
        """Create namespace on tenant signup. Returns the namespace name."""
        ns_name = f"tenant-{tenant_id}"
        self._admin.create_namespace(ns_name)
        print(f"Provisioned namespace: {ns_name}")
        return ns_name

    def get_client(self, tenant_id: str) -> DakeraClient:
        """Get (or create) a scoped client for a tenant."""
        if tenant_id not in self._tenant_clients:
            # In production: look up per-tenant scoped API key from secrets manager
            scoped_key = os.environ.get(f"DAKERA_KEY_TENANT_{tenant_id.upper()}")
            if not scoped_key:
                raise ValueError(f"No scoped key found for tenant {tenant_id}")
            self._tenant_clients[tenant_id] = DakeraClient(
                base_url="http://localhost:3300",
                api_key=scoped_key
            )
        return self._tenant_clients[tenant_id]

    def store_memory(self, tenant_id: str, content: str, **kwargs):
        client = self.get_client(tenant_id)
        return client.store_memory(
            agent_id=f"tenant-{tenant_id}",
            content=content,
            **kwargs
        )

    def recall(self, tenant_id: str, query: str, top_k: int = 5):
        client = self.get_client(tenant_id)
        return client.recall(
            agent_id=f"tenant-{tenant_id}",
            query=query,
            top_k=top_k
        )

    def list_namespaces(self) -> list:
        """Admin: list all namespaces for audit."""
        return self._admin.list_namespaces()

    def offboard_tenant(self, tenant_id: str):
        """GDPR erasure / account deletion: atomically removes all tenant data."""
        ns_name = f"tenant-{tenant_id}"
        self._admin.delete_namespace(ns_name)
        self._tenant_clients.pop(tenant_id, None)
        print(f"Deleted namespace and all data for tenant {tenant_id}")

    def get_memory_policy(self, tenant_id: str) -> dict:
        """Check the decay/lifecycle policy for a tenant's namespace."""
        return self._admin.get_memory_policy(f"tenant-{tenant_id}")


# --- Usage ---
service = TenantMemoryService(admin)

# Tenant signup
service.provision_tenant("acme-corp")
service.provision_tenant("betacorp")

# Tenant A stores confidential data
service.store_memory(
    "acme-corp",
    content="Q3 roadmap: launch Omega feature in September. 4 engineers assigned.",
    importance=0.9,
    tags=["roadmap", "confidential"]
)

# Tenant A recalls their own data
results = service.recall("acme-corp", "Q3 product roadmap")
for r in results:
    print(f"[{r['importance']:.2f}] {r['content']}")

# Audit: list all namespaces
namespaces = service.list_namespaces()
print(f"Active namespaces: {[n['name'] for n in namespaces]}")

# Account deletion (GDPR erasure)
service.offboard_tenant("acme-corp")

import { DakeraClient } from '@dakera-ai/dakera';

const admin = new DakeraClient({
  baseUrl: 'http://localhost:3300',
  apiKey: process.env.DAKERA_ADMIN_KEY!
});

class TenantMemoryService {
  private adminClient: DakeraClient;
  private tenantClients = new Map<string, DakeraClient>();

  constructor(admin: DakeraClient) {
    this.adminClient = admin;
  }

  async provisionTenant(tenantId: string): Promise<string> {
    const ns = `tenant-${tenantId}`;
    await this.adminClient.createNamespace(ns);
    console.log(`Provisioned namespace: ${ns}`);
    return ns;
  }

  private getClient(tenantId: string): DakeraClient {
    if (!this.tenantClients.has(tenantId)) {
      const key = process.env[`DAKERA_KEY_TENANT_${tenantId.toUpperCase()}`];
      if (!key) throw new Error(`No scoped key for tenant ${tenantId}`);
      this.tenantClients.set(tenantId, new DakeraClient({ baseUrl: 'http://localhost:3300', apiKey: key }));
    }
    return this.tenantClients.get(tenantId)!;
  }

  async storeMemory(tenantId: string, content: string, opts: Record<string, unknown> = {}) {
    const client = this.getClient(tenantId);
    return client.storeMemory(`tenant-${tenantId}`, { content, ...opts });
  }

  async recall(tenantId: string, query: string, topK = 5) {
    const client = this.getClient(tenantId);
    return client.recall(`tenant-${tenantId}`, query, { top_k: topK });
  }

  async listNamespaces() {
    return this.adminClient.listNamespaces();
  }

  async offboardTenant(tenantId: string) {
    await this.adminClient.deleteNamespace(`tenant-${tenantId}`);
    this.tenantClients.delete(tenantId);
    console.log(`Deleted all data for tenant ${tenantId}`);
  }
}

// --- Usage ---
const service = new TenantMemoryService(admin);

await service.provisionTenant('acme-corp');
await service.provisionTenant('betacorp');

// Tenant A stores confidential data
await service.storeMemory('acme-corp', 'Q3 roadmap: Omega feature in September', {
  importance: 0.9,
  tags: ['roadmap', 'confidential']
});

// Tenant A recalls
const results = await service.recall('acme-corp', 'Q3 product roadmap');
console.log(results.map(r => `[${r.importance}] ${r.content}`));

// Audit
const namespaces = await service.listNamespaces();
console.log('Active:', namespaces.map(n => n.name));

// GDPR erasure
await service.offboardTenant('acme-corp');

use dakera_rs::{Client, CreateNamespaceRequest, StoreMemoryRequest, RecallRequest};
use std::collections::HashMap;

struct TenantService {
    admin: Client,
    tenant_clients: HashMap<String, Client>,
}

impl TenantService {
    fn new(admin: Client) -> Self {
        Self { admin, tenant_clients: HashMap::new() }
    }

    async fn provision_tenant(&self, tenant_id: &str) -> anyhow::Result<()> {
        let ns = format!("tenant-{}", tenant_id);
        self.admin.create_namespace(&ns, CreateNamespaceRequest::default()).await?;
        println!("Provisioned namespace: {}", ns);
        Ok(())
    }

    fn get_client(&mut self, tenant_id: &str) -> &Client {
        if !self.tenant_clients.contains_key(tenant_id) {
            let key = std::env::var(format!("DAKERA_KEY_TENANT_{}", tenant_id.to_uppercase()))
                .expect("Scoped key not found");
            self.tenant_clients.insert(
                tenant_id.to_string(),
                Client::new("http://localhost:3300", &key)
            );
        }
        &self.tenant_clients[tenant_id]
    }

    async fn store_memory(&mut self, tenant_id: &str, content: &str, importance: f64) -> anyhow::Result<()> {
        let ns = format!("tenant-{}", tenant_id);
        self.get_client(tenant_id).store_memory(&ns, StoreMemoryRequest {
            content: content.to_string(),
            importance: Some(importance),
            ..Default::default()
        }).await?;
        Ok(())
    }

    async fn recall(&mut self, tenant_id: &str, query: &str, top_k: u32) -> anyhow::Result<Vec<serde_json::Value>> {
        let ns = format!("tenant-{}", tenant_id);
        let results = self.get_client(tenant_id).recall(&ns, RecallRequest {
            query: query.to_string(),
            top_k: Some(top_k),
            ..Default::default()
        }).await?;
        Ok(results)
    }

    async fn offboard_tenant(&self, tenant_id: &str) -> anyhow::Result<()> {
        let ns = format!("tenant-{}", tenant_id);
        self.admin.delete_namespace(&ns).await?;
        println!("Deleted namespace {}", ns);
        Ok(())
    }
}

package main

import (
    "context"
    "fmt"
    "os"
    dakera "github.com/dakera-ai/dakera-go"
)

type TenantService struct {
    admin         *dakera.Client
    tenantClients map[string]*dakera.Client
}

func NewTenantService(adminKey string) *TenantService {
    return &TenantService{
        admin:         dakera.NewClient("http://localhost:3300", adminKey),
        tenantClients: make(map[string]*dakera.Client),
    }
}

func (s *TenantService) ProvisionTenant(ctx context.Context, tenantID string) error {
    ns := fmt.Sprintf("tenant-%s", tenantID)
    if err := s.admin.CreateNamespace(ctx, ns, nil); err != nil {
        return err
    }
    fmt.Printf("Provisioned namespace: %s
", ns)
    return nil
}

func (s *TenantService) getClient(tenantID string) *dakera.Client {
    if _, ok := s.tenantClients[tenantID]; !ok {
        key := os.Getenv(fmt.Sprintf("DAKERA_KEY_TENANT_%s", tenantID))
        s.tenantClients[tenantID] = dakera.NewClient("http://localhost:3300", key)
    }
    return s.tenantClients[tenantID]
}

func (s *TenantService) StoreMemory(ctx context.Context, tenantID, content string, importance float64) error {
    ns := fmt.Sprintf("tenant-%s", tenantID)
    _, err := s.getClient(tenantID).StoreMemory(ctx, ns, dakera.StoreMemoryRequest{
        Content:    content,
        Importance: importance,
    })
    return err
}

func (s *TenantService) Recall(ctx context.Context, tenantID, query string, topK int) ([]dakera.Memory, error) {
    ns := fmt.Sprintf("tenant-%s", tenantID)
    return s.getClient(tenantID).Recall(ctx, ns, dakera.RecallRequest{
        Query: query,
        TopK:  topK,
    })
}

func (s *TenantService) OffboardTenant(ctx context.Context, tenantID string) error {
    ns := fmt.Sprintf("tenant-%s", tenantID)
    return s.admin.DeleteNamespace(ctx, ns)
}

// Usage
func main() {
    svc := NewTenantService(os.Getenv("DAKERA_ADMIN_KEY"))
    ctx := context.Background()

    svc.ProvisionTenant(ctx, "acme-corp")
    svc.StoreMemory(ctx, "acme-corp", "Q3 roadmap: Omega feature in September", 0.9)

    results, _ := svc.Recall(ctx, "acme-corp", "Q3 roadmap", 5)
    for _, r := range results {
        fmt.Printf("[%.2f] %s
", r.Importance, r.Content)
    }
}